Extracted

• • Target
    INVOICE 19365.JS
  • Size 3.3MB
  • SHA256 fc3b7db44556473a0ce1c083bf4d9d4da2513d15a9127e544bc6bd8361951ac7
  • MD5 a35784beef217f7217b054f6dda7246b
  • SHA1 c3c278bc268fb6bf405d491c97926ef24fcbe50b
  • SHA512 ab1bfb888e53a15d3d62984a2b22275bcecb0b343034774621b00d9489112ebf1cdf7a661a4b4fbfdac6e912fdc5b22f05b0243c0e133fb417e0a477708594bc
  • SSDEEP 98304:kIt3fggs5YesjlssAZW38/xt0bF0GExr8k2SkJeg9+6b5vc2o+A6vgHpuTJF9M+b:kIt3fggs5YesjlssAZW38/xt0bF0GExa
  • TLSH
    T1FEF51B8B1BC959233734FBFA512EEDB0D20A465314059B13707CFA4B3B6DE04A6587BA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerpersistencespywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2